FCA policy statement, Strengthening accountability in banking and insurance: regulatory references final rules (PS16/22), was published on 28 September 2016. It sets out the final rules relating to regulatory references, which form part of the senior managers regime (SMR) and the senior insurance managers regime (SIMR) introduced in March 2016, for deposit-takers, PRA investment firms and certain insurance firms. The FCA consulted jointly with the PRA on the proposals in CP15/31, which was published in October 2015. (The PRA published a separate policy statement (PS27/16) to the consultation paper, the content of which is outside the scope of this article.)

PS16/22 acknowledges that, "references are a key tool in allowing firms to share relevant information on individuals to support their assessment of potential new recruits as fit and proper".

The mandatory form and final rules for regulatory references are designed to implement the recommendations of the 2015 Fair and Effective Markets Review (FEMR) and "help firms prevent the 'recycling' of individuals with poor conduct records between firms". The final rules will come into force on 7 March 2017.

Unfortunately, as outlined in our previous article (published in January 2016), the final rules retain a focus on concluded breaches that, coupled with the removal of Forms C and D, and the fact that the regulator will no longer be involved in the assessment of a certified person's fitness and propriety, are likely to leave the issue of rolling bad apples among the population of certified persons unresolved.

For information on fitness and propriety, see Practice note, Fitness and propriety in the SMR and certification regime for banks and PRA-designated investment firms.

At first glance, the rules appear to be far-reaching:

The FCA considers that regulated firms should be able to provide a regulatory reference within six weeks of a request. The only real concession offered by PS16/22 concerns intra-group moves. Firms do not need to request a reference intra-group where the group has "centralised records or alternative means of sharing information as part of the fit and proper assessment of candidates".

Consistent with the changes to the notification requirements in the Financial Services and Markets Act 2000 (FSMA), the final rules require firms to only disclose:

The reference must contain a factual description of the breach (including the date(s) of when it occurred and the basis for disciplinary action) and the outcome.

PS16/22 confirms that there is no requirement to disclose "suspensions imposed pending an internal investigation". The reduction or recovery of remuneration must only be disclosed where this is imposed as a result of a breach of conduct requirements. This places the focus of mandatory disclosures firmly on actual or concluded breaches. An individual who resigns during an investigation into alleged misconduct may therefore carry on "rolling" to the next firm unless their former employer determines that this amounts to other "relevant information" that should be disclosed (see Other relevant information below).

In the past, a firm would have filed a form C where an approved person was suspended pending an investigation or resigned while under investigation (or a Form D in connection with material changes impacting on an individual's fitness and propriety); this information would have been taken into account in the assessment of the individual's fitness and propriety for any new role.

The FCA acknowledges that the requirement to provide "all relevant information" generated considerable feedback to CP15/31 regarding what this would capture (beyond the mandatory disclosures) and the need to ensure consistency of approach. Firms are left to make a judgment on a case-by-case basis, having regard to their general duty to give fair and accurate references, with obligations to both the ex-employee and the recipient of the reference. However, the final rules confirm that firms are not required to disclose "information that has not been properly verified".

The position is summarised in the new Chapter 22 of the Senior Management Arrangements Systems and Controls sourcebook (SYSC):

This leaves the regulatory lacuna that we identified in our original article unresolved.

SYSC 22.5.18G addresses the duty to investigate allegations and provides that: "(1) A firm should, wherever feasible, conclude investigative procedures before the employee departs. (2) However, this chapter does not create a duty to investigate alleged misconduct by an employee or former employee". The guidance goes on to consider reasons why a firm may find it appropriate to investigate potential misconduct by an employee or former employee, but there is clearly no duty to investigate.

Firms will have to be confident that the fact of a resignation while under investigation is sufficiently significant to warrant disclosure to the new employer. They will also need to emphasise that no findings have been made. Any new employer is likely to request more information about the circumstances leading to the investigation and resignation, with the result that the former employer may face claims from both the departing employee (if they are not hired) or the new employer (if they make a poor hiring decision based on piecemeal information from the former employer). In the circumstances, it seems unlikely that firms will volunteer this information unless a common approach is adopted across the industry.

The difficulties facing employers are exacerbated by the requirement to update references that have been given over the past six years where new information has become available, which is significant for an assessment of fitness and propriety. Respondents to CP15/31 raised the issue of whether there was a duty to investigate potential breaches where an individual had left the firm and whether a former employee had to be offered a right to reply in such circumstances. The FCA puts the onus back on employers: "we do not think that a financial services regulator is best placed to give guidance on common law or employment law".

The decision to investigate potential breaches remains a matter for the individual firms to decide. The FCA has "not imposed a duty on firms to investigate alleged misconduct by an employee or ex-employee". Again, firms are expected to make a judgment as to whether to embark on an investigation of matters concerning a former employee. The rules on regulatory references do not oblige firms to take this step and, as respondents to CP15/31 noted, provide little incentive for firms to do so.

If a firm decides to investigate a former employee, the fairness of its processes and any subsequent reference will be compromised unless the departing employee has an opportunity to comment on the allegations in question. Given the potential impact on future career, and the historic nature of the allegations, such investigations are likely to become very protracted. A firm is unlikely to update a reference unless the findings of a post-departure investigation were unequivocal and the employee had participated fully in that process (in all likelihood with the benefit of their own legal representation).

The final rules on regulatory references have limited the scope of mandatory disclosures so that they align with the FSMA notification regime. Although firms retain an obligation to disclose other "relevant information", the FCA rules make it clear that there is no regulatory requirement to reveal the fact that an individual resigned during the course of an investigation. This, coupled with the absence of any duty to investigate potential misconduct post-departure, leaves the question of "rotten apples" unresolved for certified persons. Meanwhile, the regulator is only ever likely to learn of a problem where the individual's conduct gave rise to a notification under Chapter 15 of the Supervision manual (SUP) in view of its impact on the firm.

For more information on regulatory references, see Practice note, Regulatory references under the SMR and SIMR.